A few outdated npm modules

[pdehaan]

Not sure if we want to bump any of these.
It looks like react@15 was released yesterday https://facebook.github.io/react/blog/2016/04/07/react-v15.html
And history had a major version bump.

$ npm outdated

Package	Current	Wanted	Latest	Location	Type
history	1.17.0	1.17.0	2.0.1	activity-streams	dep (major)
moment	2.11.2	2.11.2	2.12.0	activity-streams	dep (minor)
react	0.14.7	0.14.7	15.0.1	activity-streams	dep (major)
react-dom	0.14.7	0.14.7	15.0.1	activity-streams	dep (major)
react-redux	4.1.2	4.1.2	4.4.1	activity-streams	dep (minor)
react-router	1.0.3	1.0.3	2.0.1	activity-streams	dep (major)
redux	3.2.0	3.2.0	3.3.1	activity-streams	dep (minor)
redux-logger	2.4.0	2.4.0	2.6.1	activity-streams	dep (minor)
redux-thunk	1.0.3	1.0.3	2.0.1	activity-streams	dep (major)
url-parse	1.0.5	1.0.5	1.1.1	activity-streams	dep (minor)
husky	0.10.2	0.10.2	0.11.4	activity-streams	devDep 🚧
istanbul-instrumenter-loader	0.1.3	0.1.3	0.2.0	activity-streams	devDep 🚧
karma-mocha-reporter	1.3.0	1.3.0	2.0.0	activity-streams	devDep 🚧
react-addons-test-utils	0.14.8	0.14.8	15.0.1	activity-streams	devDep 🚧
redux-mock-store	0.0.6	0.0.6	1.0.2	activity-streams	devDep 🚧
webpack-notifier	1.3.0	1.3.1	1.3.0	activity-streams	devDep 🚧
yamscripts	0.0.2	0.0.2	0.0.3	activity-streams	devDep 🚧

[Standard8]

On Hello, we used greenkeeper.io to help keep us up to date - it automatically submits PRs when a version bump happens. The PRs typically tell you what's changed (not always, depends on the package), and, of course, tests run automatically. You can then choose to merge it (and when), or do some work on the branch before you merge.

From my perspective here's some notes about the advantages/disadvantages:

• It kept us up to date with modules, allowing small bumps and we could easily see breaking changes.
• We were able to get the latest bug fixes & occasionally new features we needed without having to monitor the package updates manually (e.g. sometimes we submitted fixes to mocha & sinon that we wanted to pick up).
• No more manual work to find out-of-date dependencies & create patches/do tests.
• The default format of the commit message is "chore(package): update karma to version 1.1.2. (#nnn)", which I think fits with your changelog formats. We generally modified that message on landing to add the "r=foo" annotation, but github makes that simple with the squash & merge option.
• Greenkeeper will only create branches in the main repository, so there's a bit of extra noise, and you sometimes have to close the old branches (though mainly just do it when closing PRs)
• Greenkeeper requires github API access through someone's account (who's an admin for the repo). We haven't had any issues allowing this, though it does mean we need to remember who enabled it.

Generally I think we can say its been very useful on Hello in keeping us up to date whilst providing low overhead.

@tspurway @k88hudson Is this something you want to enable here?

If so, I'd suggest that there's a one-off PR to create to update to the current latest versions, and then once that has landed, then enable greenkeeper. I'd be happy to create the PR if that's what we want.

[tspurway]

LGTM, @Standard8 - thanks for the tip!

Unless anyone has any objections, I think we should go ahead and do this. Does Mozilla have an existing Greenkeeper account we can use?

[Standard8]

@tspurway We used the free account - its free for organisations with public repos.

Unless you mean an already integrated github account?

[Standard8]

Actually, there's already about 9-10 other mozilla repos using greenkeeper today.

[Standard8]

I'm going to be out next week. Feel free to merge the remaining PRs.

I'll look at doing the actual enable of greenkeeper when I get back.

[Mardak]

All referenced PRs have been merged.

[Standard8]

Reopening until we have greenkeeper set up, which was part of the proposed plan for resolving this (I plan on doing that today or tomorrow).

[Standard8]

greenkeeper is now enabled on the repo. For posterity I did:

npm install -g greenkeeper
greenkeeper login
greenkeeper --slug=mozilla/activitystream enable

Anyone with admin access to the repo should be able to disable this in future. See greenkeeper.io for details.

PR #1089 is the first of the greenkeeper PRs, which I'm working on getting landed.